Getting Started

Get up and running with Thand Agent quickly and easily.

Table of contents

  1. Installation
    1. Install via script
    2. Install via Homebrew (macOS/Linux)
    3. Install via Binary Release
    4. Build from Source
  2. Configuration
    1. Basic Configuration
    2. Environment Variables
  3. First Steps
    1. 1. Authenticate
    2. 3. Request Access
    3. 4. Use Your Access
  4. Common Use Cases
    1. Local Sudo Access
  5. Next Steps

By default thand will authenticate to auth.thand.io but you can specify your own server. Your administrator will provide the server URL. If you are setting this up in your own environment you will need to first deploy the Thand server in your environment. Please see the Environment Setup for more information.

Installation

Install via script 

# Install agent (https://github.com/thand-io/agent/blob/main/scripts/install.sh). Trust but verify!
curl -sSL https://get.thand.io | sh

Install via Homebrew (macOS/Linux) 

brew tap thand-io/tap
brew install thand

Install via Binary Release

Download the latest binary for your platform from the GitHub Releases page:

# Linux/macOS
curl -L -o thand https://github.com/thand-io/agent/releases/latest/download/agent-$(uname -s)-$(uname -m)
chmod +x thand
sudo mv thand /usr/local/bin/

# Windows (PowerShell)
Invoke-WebRequest -Uri "https://github.com/thand-io/agent/releases/latest/download/agent-windows-amd64.exe" -OutFile "thand.exe"

Build from Source

Before installing Thand Agent, ensure you have:

  • Go 1.21 or later (if building from source)
  • Access to your target infrastructure (GCP, AWS, etc.)

Clone the repository and build the agent:

git clone https://github.com/thand-io/agent.git
cd agent
make submodules
make build

The binary will be available at bin/agent.

Configuration

Basic Configuration

Create a configuration file at ~/.thand/config.yaml:

server:
  url: "https://your-thand-server.com"
  
agent:
  listen_port: 8080
  session_timeout: "1h"
  
logging:
  level: "info"
  format: "json"

Environment Variables

You can also configure the agent using environment variables:

export THAND_SERVER_URL="https://your-thand-server.com"
export THAND_AGENT_PORT="8080"
export THAND_LOG_LEVEL="info"

First Steps

1. Authenticate

Initialize your authentication with the Thand server:

thand login

Or via a thand login server.

thand login --server http://localhost:9090

This will open your browser for authentication or provide a device code flow. Once authenticated, your session will be cached locally. You can view your current session with:

thand sessions

3. Request Access

Request access to a resource:

# Request AWS access for 1 hour
thand request access --provider aws-prod --role Admin --duration 1h --reason "Deploying new version"

# Request GCP access
thand request access --provider gcp --project my-project --role viewer

# Request via natural language
thand "Get me admin access to AWS production for 2 hours to perform maintenance"

4. Use Your Access

Once approved, the agent will provide temporary credentials:

# AWS credentials are automatically configured
aws s3 ls

# GCP credentials are set via environment
gcloud projects list

Common Use Cases

Local Sudo Access

Request temporary sudo access on your local machine:

thand-agent request sudo --duration 30m --reason "System maintenance"

Next Steps